Privacy Policy

1. Who we are

Dooit is operated by Sprike LLC, a Delaware limited liability company located at 8 The Green, STE R, Dover, DE 19901, United States. For residents of the European Economic Area (EEA) and the United Kingdom, Sprike LLC is the “data controller” responsible for your personal data. You can reach us any time at support@dooit.so.

2. Information we collect

We collect the following categories of information:

Account information.

When you create an account, our authentication provider (Clerk) collects your email address and, depending on how you sign up, your name, password, profile photo, and identifiers from any third-party login you use (such as Google or Apple). We use this to identify you and secure your account.

Content you create.

Dooit stores the content you add to the Service so we can show it back to you and sync it across your devices — including your tasks, projects, goals, habits and habit check-ins, statuses, sections, filters, project notes, custom emoji images you upload, and related settings such as your timezone and view preferences.

Billing information.

If you subscribe to Dooit Pro, our payment processor (Stripe) collects your name, email, billing address, and payment-method details to process the transaction. We do not receive or store your full card number. We retain a limited record of your subscription status and billing history so we can give you access to paid features and support.

Technical and log information.

Like any website, our hosting provider (Vercel) and backend (Convex) automatically receive standard request data such as your IP address, browser and device type, and timestamps in their server logs. We also store metadata for any REST API tokens you create (a name, a hashed token, the token prefix, and usage timestamps). API tokens are stored hashed; we cannot recover the original value.

Demo mode.

You can try Dooit without an account using the live demo. Demo sessions run under a randomly generated guest identifier and do not require an email or any personal information. Demo workspaces are seeded with sample data and are automatically and permanently deleted after a short period of inactivity.

What we don’t collect.

We do not use third-party analytics, advertising pixels, session recording, heatmaps, or behavioral tracking of any kind. We do not build advertising profiles, and we do not use your content to train AI models.

3. How we use your information

We use the information above to:

• provide, maintain, and sync the Service across your devices;
• create and secure your account and authenticate you;
• process subscriptions, trials, and payments, and provide related receipts and support;
• run scheduled tasks that keep the product working, such as rolling over recurring tasks in your timezone;
• respond to your requests and provide customer support;
• detect, prevent, and address abuse, security incidents, and technical problems; and
• comply with our legal obligations.

For users in the EEA and UK, we rely on the following legal bases: performance of our contract with you (to provide the Service and billing), our legitimate interests (to keep the Service secure and working), your consent where required, and compliance with legal obligations.

4. How we share your information

We do not sell your personal information and we do not share it for advertising. We share data only with the service providers (“subprocessors”) that help us run Dooit, and only as needed to provide the Service:

Each of these providers is bound by its own privacy and security commitments. We may also disclose information if required by law, to enforce our agreements, to protect the rights, safety, and security of our users or the public, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you of any change in ownership or use of your personal data).

5. Cookies and local storage

We use a small number of strictly necessary cookies, set by our authentication provider, to keep you signed in and secure your session. We also use your browser’s local storage to remember interface preferences — such as your chosen view, sidebar state, and panel sizes — and to maintain a demo session. We do not use advertising or third-party tracking cookies.

6. Data retention

We keep your account and content for as long as your account is active. When you delete your account, we schedule it for permanent deletion after a 30-day grace period, after which your data is removed from our backend and your authentication record is deleted. Archived tasks are permanently deleted roughly 30 days after they are archived. Demo (guest) workspaces are deleted automatically after a short period of inactivity. We may retain limited billing records where required for tax, accounting, or legal compliance.

7. Data security

Data is encrypted in transit (HTTPS) and at rest by our hosting and infrastructure providers. Access to production systems is limited, and sensitive credentials such as API tokens are stored hashed. No method of transmission or storage is completely secure, so while we work hard to protect your information, we cannot guarantee absolute security.

8. International data transfers

Dooit and its service providers are based in the United States, and your information will be processed there. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country. Where required, our providers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses for such transfers.

9. Your privacy rights (EEA and UK)

If you are in the EEA or UK, you have the right to access, correct, update, or delete your personal data; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data-protection authority. To exercise any of these rights, email us at support@dooit.so. Many actions — such as editing your content or deleting your account — can also be done directly in the app.

10. Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and share it, the right to request deletion of your personal information, the right to correct inaccurate information, and the right not to be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. To exercise your rights, contact us at support@dooit.so.

11. Children's privacy

Dooit is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service. Your continued use of Dooit after an update means you accept the revised policy.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your data, contact us at support@dooit.so or by mail at Sprike LLC, 8 The Green, STE R, Dover, DE 19901, United States.